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Decoy states have been proven to be a very useful method for significantly enhancing the perfor- 
mance of quantum key distribution systems with practical light sources. While active modulation of 
the intensity of the laser pulses is an effective way of preparing decoy states in principle, in practice 
passive preparation might be desirable in some scenarios. Typical passive schemes involve paramet- 
ric down-conversion. More recently, it has been shown that phase randomized weak coherent pulses 
(WCP) can also be used for the same purpose [M. Curty et al, Opt. Lett. 34, 3238 (2009).] This 
proposal requires only linear optics together with a simple threshold photon detector, which shows 
the practical feasibility of the method. Most importantly, the resulting secret key rate is comparable 
to the one delivered by an active decoy state setup with an infinite number of decoy settings. In this 
paper we extend these results, now showing specifically the analysis for other practical scenarios 
with different light sources and photo-detectors. In particular, we consider sources emitting ther- 
mal states, phase randomized WCP, and strong coherent light in combination with several types of 
photo-detectors, like, for instance, threshold photon detectors, photon number resolving detectors, 
and classical photo-detectors. Our analysis includes as well the effect that detection inefficiencies 
and noise in the form of dark counts shown by current threshold detectors might have on the final 
secret ket rate. Moreover, we provide estimations on the effects that statistical fluctuations due to 
a finite data size can have in practical implementations. 
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I. INTRODUCTION 



Quantum key distribution (QKD) is the first quan- 
tum information task that reaches the commercial mar- 
ket to offer efficient and user-friendly cryptographic sys- 
tems providing an unprecedented level of security [l[ . It 
allows two distant parties (typically called Alice and Bob) 
to establish a secure secret key despite the computational 
and technological power of an eavesdropper (Eve), who 
interferes with the signals @. This secret key is the es- 
sential ingredient of the one-time-pad or Vernam cipher 
Q, the only known encryption method that can deliver 
information-theoretic secure communications. 

Practical implementations of QKD are usually based 
on the transmission of phase randomized weak coherent 
pulses (WCP) with typical average photon number of 0.1 
or higher These states can be easily prepared using 
only standard semiconductor lasers and calibrated atten- 
uators. The main drawback of these systems, however, 
arises from the fact that some signals may contain more 
than one photon prepared in the same quantum state. 
When this effect is combined with the considerable at- 
tenuation introduced by the quantum channel (about 0.2 
dB/km), it opens an important security loophole. Eve 
can perform, for instance, the so-called Photon Number 
Splitting attack on the multi-photon pulses [f|. This at- 



tack provides her with full information about the part of 
the key generated with the multi-photon signals, without 
causing any disturbance in the signal polarization. As a 
result, it turns out that the standard BB84 protocol @ 
with phase randomized WCP can deliver a key gener- 
ation rate of order 0(rj 2 ), where r\ denotes the trans- 
mission efficiency of the quantum channel @, §]■ This 
poor performance contrasts with the one expected from 
a QKD scheme using a single photon source, where the 
key generation rate scales linearly with r\. 

A significant improvement of the achievable secret key 
rate can be obtained if the original hardware is slightly 
modified. For instance, one can use the so-called decoy 
state method H, EH EL EH, which can basically reach the 
performance of single photon sources. The essential idea 
behind decoy state QKD with phase randomized WCP is 
quite simple: Alice varies, independently and randomly, 
the mean photon number of each signal state she sends 
to Bob by employing different intensity settings. This is 
typically realized by means of a variable optical attenu- 
ator (VOA) together with a random number generator. 
Eve does not know a priori the mean photon number 
of each signal state sent by Alice. This means that her 
eavesdropping strategy can only depend on the actual 
photon number of these signals, but not on the partic- 
ular intensity setting used to generate them. From the 
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measurement results corresponding to different intensity 
settings, the legitimate users can obtain a better estima- 
tion of the behavior of the quantum channel. This fact 
translates into an enhancement of the resulting secret key 
rate. The decoy state technique has been successfully im- 
plemented in several recent experiments fl3| , which show 
the practical feasibility of this method. 

While active modulation of the intensity of the pulses 
suffices to perform decoy state QKD in principle, in prac- 
tice passive preparation might be desirable in some sce- 
narios. For instance, in those experimental setups oper- 
ating at high transmission rates. Passive schemes might 
also be more resistant to side channel attacks than ac- 
tive systems. For example, if the VOA which changes 
the intensity of Alice's pulses is not properly designed, it 
may happen that some physical parameters of the pulses 
emitted by the sender depend on the particular setting 
selected. This fact could open a security loophole in the 
active schemes. 

Known passive schemes rely typically on the use of a 
parametric down-conversion (PDC) source together with 
a photon detector [3, EE EH- The main idea behind 
these proposals comes from the photon number corre- 
lations that exist between the two output modes of a 
PDC source. By measuring the photon number distribu- 
tion of one output mode it is possible to infer the pho- 
ton number statistics of the other mode. In particular, 
Ref. [HI considers the case where Alice measures one of 
the output modes by means of a time multiplexed de- 
tector (TMD) which provides photon number resolution 
capabilities [13] ; Ref. [l5[ analyzes the scenario where the 
detector used by Alice is just a simple threshold detector, 
while the authors of Ref. [l6[ generalize the ideas intro- 
duced by Mauerer et al. in Ref. [3 to QKD setups using 
triggered PDC sources. All these schemes nearly reach 
the performance of a single photon source. 

More recently, it has been shown that phase random- 
ized WCP can also be used for the same purpose [HI]. 
That is, one does not need a non-linear optics network 
preparing entangled states. The crucial requirement of 
a passive decoy state setup is to obtain correlations be- 
tween the photon number statistics of different signals; 
hence it is sufficient that these correlations are classi- 
cal. The main contribution of Ref. [l8| is rather simple: 
When two phase randomized coherent states interfere at 
a beam splitter (BS), the photon number statistics of 
the outcome signals are classically correlated. This effect 
contrasts with the one expected from the interference of 
two pure coherent states with fixed phase relation at a 
BS. In this last case, it is well known that the photon 
number statistics of the outcome signals is just the prod- 
uct of two Poissonian distributions. Now the idea is sim- 
ilar to that of Refs. [H|, EH, [Hj]: By measuring one of the 
two outcome signals of the BS, the conditional photon 
number distribution of the other signal varies depending 
on the result obtained [HI . In the asymptotic limit of an 
infinite long experiment, it turns out that the secret key 
rate provided by such a passive scheme is similar to the 



one delivered by an active decoy state setup with infinite 
decoy settings [l8| • A similar result can also be obtained 
when Alice uses heralded single-photon sources showing 
non-Poissonian photon number statistics [l9| . 

In this paper we extend the results presented in 
Ref. [HI, now showing specifically the analysis for other 
practical scenarios with different light sources and photo- 
detectors. In particular, we consider sources emitting 
thermal states and phase randomized WCP in combina- 
tion with threshold detectors and photon number resolv- 
ing (PNR) detectors. In the case of threshold detectors, 
we include as well the effect that detection inefficiencies 
and dark counts present in current measurement devices 
might have on the final secret ket rate. For simplicity, 
these measurement imperfections were not considered in 
Ref. [Hj]. On the other hand, PNR detectors allows us 
to obtain ultimate lower bounds on the maximal per- 
formance that can be expected at all from this kind of 
passive setups. We also present a passive scheme that 
employs strong coherent light and does not require the 
use of single photon detectors, but it can operate with 
a simpler classical photo-detector. This fact makes this 
setup specially interesting from an experimental point of 
view. Finally, we provide an estimation on the effects 
that statistical fluctuations due to a finite data size can 
have in practical implementations. 

The paper is organized as follows. In Sec. [II] we review 
very briefly the concept of decoy state QKD. Next, in 
Sec. IIIII we present a simple model to characterize the 
behavior of a typical quantum channel. This model will 
be relevant later on, when we evaluate the performance 
of the different passive schemes that we present in the fol- 
lowing sections. Our starting point is the basic passive 
decoy state setup introduced in Ref. [H}. This scheme 
is explained very briefly in Sec. IIVI Then, in Sec. [V] 
we analyze its security when Alice uses a source of ther- 
mal light. Sec. I VII and Sec. IVIII consider the case where 
Alice employs a source of coherent light. First, Sec. [VI] 
investigates the scenario where the states prepared by Al- 
ice are phase randomized WCP. Then, Sec. IVIII presents 
a passive decoy state scheme that uses strong coherent 
light. In Sec. IVIIII we discuss the effects of statistical 
fluctuations. Finally, Sec. IIXI concludes the paper with a 
summary. 



II. DECOY STATE QKD 

In decoy state QKD Alice prepares mixtures of Fock 
states with different photon number statistics and sends 
these states to Bob [H, [ill EH EH ■ The photon number 
distribution of each signal state is chosen, independently 
and at random, from a set of possible predetermined set- 
tings. Let p l n denote the conditional probability that a 
signal state prepared by Alice contains n photons given 
that she selected setting I, with I g {0, . . . , m}. For in- 
stance, if Alice employs a source of phase randomized 
WCP then p l n = e^^/i^/nl, and she varies the mean 
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photon number (intensity) jj,i of each signal. Assuming 
that Alice has choosen setting I, such states can be de- 
scribed as 



(i) 



n=0 



where \n) denote Fock states with n photons. 

The gain Q l corresponding to setting I, i.e., the proba- 
bility that Bob obtains a click in his measurement appa- 
ratus when Alice sends him a signal state prepared with 
setting I, can be written as 



n=0 



(2) 



where Y„ denotes the yield of an n-photon signal, i.e., 
the conditional probability of a detection event on Bob's 
side given that Alice transmitted an n-photon state. Sim- 
ilarly, the quantum bit error rate (QBER) associated to 
setting I, that we shall denote as E, is given by 



Q l E l 



71=0 



(3) 



with e n representing the error rate of an n-photon signal. 

Now the main idea of decoy state QKD is very simple. 
From the observed data Q l and E , together with the 
knowledge of the photon number distributions p l n , Alice 
and Bob can estimate the value of the unknown parame- 
ters Y n and e n just by solving the set of linear equations 
given by Eqs. (0)-©. For instance, in the general sce- 
nario where Alice employs an infinite number of possible 
decoy settings then she can estimate any finite number 
of parameters Y n and e„ with arbitrary precision. On 
the other hand, if Alice and Bob are only interested in 
the value of a few probabilities (typically Yo, Y\, and 
ei), then they can estimate them by means of only a few 
different decoy settings [hJ EH, E3 ■ 

In this paper we shall consider that Alice and Bob 
treat each decoy setting separately, and they distill se- 
cret key from all of them. We use the security analysis 
presented in Ref. [Io| . which combines the results pro- 
vided by Gottesman-Lo-Liitkenhaus-Preskill (GLLP) in 
Ref. [|[ (see also Ref. [20j|) with the decoy state method. 
Specifically, the secret key rate formula can be written as 



R > ^2max{R l ,0}, 



(4) 



;=o 



where R satisfies 



R l > q{-Q l f(E l )H(E l ) +dYi.[l - ff(ei)] + p Y }. (5) 

The parameter q is the efficiency of the protocol (q = 
1/2 for the standard BB84 protocol [||, and q m 1 
for its efficient version [2l|): f(E l ) is the efficiency of 
the error correction protocol as a function of the error 



rate E l [13], typically f(E l ) > 1 with Shannon limit 
f(E l ) = 1; e\ denotes the single photon error rate; 
H{x) = — xlog 2 (x) — (1 — x) log 2 (1 — x) is the binary 
Shannon entropy function. 

To apply the secret key rate formula given by Eq. ([5]) 
one needs to solve Eqs. ©-([2]) m order to estimate the 
quantities Yo, Yi, & n d &\. For that, we shall use the pro- 
cedure proposed in Ref. 12 [. This method requires that 
the probabilities p l n satisfy certain conditions. It is im- 
portant to emphasize, however, that the estimation tech- 
nique presented in Ref. [12] only constitutes a possible 
example of a finite setting estimation procedure and no 
optimality statement is given. In principle, many other 
estimation methods are also available for this purpose, 
like, for instance, linear programming tools [231 ]. which 
might result in a sharper, or for the purpose of QKD 
better, bounds on the considered probabilities. 



III. CHANNEL MODEL 

In this section we present a simple model to describe 
the behavior of a typical quantum channel. This model 
will be relevant later on, when we evaluate the perfor- 
mance of the passive decoy state setups that we present 
in the following sections. In particular, we shall consider 
the channel model used in Refs. [13, E3- This model re- 
produces a normal behavior of a quantum channel, i.e., 
in the absence of eavesdropping. Note, however, that 
the results presented in this paper can also be applied to 
any other quantum channel, as they only depend on the 
observed gains Q l and error rates E l . 



A. Yield 

There are two main factors that contribute to the 
yield of an n-photon signal: The background rate Yd, 
and the signal states sent by Alice. Usually Y is, to a 
good approximation, independent of the signal detection. 
This parameter depends mainly on the dark count rate 
of Bob's detection apparatus, together with other back- 
ground contributions like, for instance, stray light coming 
from timing pulses which are not completely filtered out 
in reception. In the scenario considered, the yields Y n 
can be expressed as [13, E3 

Y n = l-(l-Yo)(l-r7 sys ) n , (6) 

where 77 sys represents the overall transmittance of the sys- 
tem. This quantity can be written as 

Vsys = ^channel ?7Bob, (7) 

where ?7channci is the transmittance of the quantum chan- 
nel, and f?Bob denotes the overall transmittance of Bob's 
detection apparatus. That is, neob includes the trans- 
mittance of any optical component within Bob's mea- 
surement device and the detector efficiency. The param- 
eter ^channel can be related with a transmission distance 
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FIG. 1: Basic setup of a passive decoy state QKD scheme: 
Interference of two Fock diagonal states, p and a, at a beam 
splitter (BS) of transmittance t; a and b represent the two 
output modes. 



d measured in km for the given QKD scheme as 

^channel = 10"^, (8) 

where a represents the loss coefficient of the channel (e.g., 
an optical fiber) measured in dB/km. 

B. Quantum bit error rate 

The n-photon error rate e n is given by [lol , [l2| 



Y e + (Y n -Y )e d 
Y 

1 n 



(9) 



where e<2 is the probability that a signal hits the wrong 
detector on Bob's side due to the misalignment in the 
quantum channel and in his detection setup. For sim- 
plicity, here we assume that e<i is a constant independent 
of the distance. Moreover, from now on we shall consider 
that the background is random, i.e., eg = 1/2. 



IV. PASSIVE DECOY STATE QKD SETUP 

The basic setup is rather simple [HI]. It is illustrated 
in Fig. [TJ Suppose two Fock diagonal states 



n=Q 

oo 

a = r n \n)(r 



(10) 



n=0 



interfere at a BS of transmittance t. If the probabilities 
p n and r n are properly selected, then it turns out that the 
photon number distributions of the two outcome signals 
can be classically correlated. By measuring the signal 
state in mode b, therefore, the conditional photon number 
statistics of the signal state in mode a vary depending on 
the result obtained. 

In the following sections we analyze the setup repre- 
sented in Fig. [T] for different light sources and photo- 
detectors. We start by considering a simple source of 
thermal states. Afterwards, we investigate more practi- 
cal sources of coherent light. 



V. THERMAL LIGHT 

Suppose that the signal state p which appears in Fig. [1] 
is a thermal state of mean photon number p. Such state 
can be written as 



— e(- 



/' 



\n)(n\ 



(11) 



and let a be a vacuum state. In this scenario, the joint 
probability of having n photons in output mode a and m 
photons in output mode b (see Fig. [1} has the form 



Pn 



^("i;)(i^)""-"-'>- (-) 



That is, depending on the result of Alice's measurement 
in mode b, the conditional photon number distribution 
of the signals in mode a varies. 

In particular, we have that whenever Alice ignores the 
result of her measurement, the total probability of finding 
?i photons in mode a can be expressed as 



°° 1 



fit \" 



rn=0 



fj,t\l + pt 



(13) 



Next, we consider the case where Alice uses a threshold 
detector to measure mode b. 



A. Threshold detector 

Such a detector can be characterized by a positive op- 
erator value measure (POVM) which contains two ele- 
ments, F vac and F c i ick , given by [11] 

CO 

F vac = (l-e)J2(l-m) n \n)(n\, 
F click = 1-F vac . (14) 

The parameter rjd denotes the detection efficiency of the 
detector, and e represents its probability of having a dark 
count. Eq. (|14[) assumes that e is, to a good approxima- 
tion, independent of the incoming signals. The outcome 
of i^ac corresponds to "no click" in the detector, while 
the operator F c i; c k gives precisely one detection "click", 
which means at least one photon is detected. 

The joint probability for seeing n photons in mode a 
and no click in the threshold detector, which we shall 
denote as p^, has the form 

Pi = (1 - e) J2 (1 - m) m Pn, m = (n U , (15) 

m=0 



with the parameter r given by 

r = 1 + n[t + (1 - <)ry d ] 



(16) 
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FIG. 2: Conditional photon number distribution in mode a 
(see Fig. [TJ: 9n (black) versus q£ (grey) when p is given by 
Eq. and cr is a vacuum state. We use = 1 and t = 1/2, 
and we study two situations: (A) A perfect threshold photon 
detector, i.e., e = and r/a — 1, and (B) e — 3.2 x 1CP 7 
and rjd — 0.12. These last data correspond to the experiment 
reported by Gobby et al. in Ref. [25l |. 



If the detector produces a click, the joint probability of 
finding n photons in mode a is given by 



Pn Pn Pn ' 



(17) 



Figure [5] shows the conditional photon number statis- 
tics of the outcome signal in mode a depending on the 
result of the threshold detector (click and not click): 
In =Pn/( 1 - Nth) and q z n = p£/iVth, with 



N 



th 



n=0 



1 



l + /iJ7d(l-*) 



(18) 



B. 



Lower bound on the secret key rate 



We consider that Alice and Bob distill secret key both 
from click and no click events. The calculations to esti- 
mate the yields Yq and Yi, together with the single pho- 
ton error rate e\ , are included in Appendix [X] 

For simulation purposes we use the channel model de- 
scribed in Sec. IHIl After substituting Eqs. ©-([9]) into 
the gain and QBER formulas we obtain that the param- 
eters Q c , E c , Q l , and E l can be written as 



N 



th 



(i-e)(i-y ) ; 

r - (1 - 7? sys )/xi' 
Q 5 E S = {e a ~e d )Y N th + e d Q 5 , 
nt _ Y o + ^tr] sys 



1 + pitr). 



Q'E* = (e - e d )Y + e d Q\ 



(19) 



where Q c = Q l - Q e and Q C E C = Q t E t - Q e E 5 . 

The resulting lower bound on the secret key rate is 
illustrated in Fig. [3] (dashed line) . We employ the exper- 
imental parameters reported by Gobby et al. in Ref. [2 51 ] : 
Y Q = 1.7 x 10" 6 , e d = 0.033, a = 0.21 dB/km, and Bob's 
detection efficiency 7/Bob = 0.045. We further assume 
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FIG. 3: Lower bound on the secret key rate R given by 
Eq. @ in logarithmic scale for the passive decoy state setup 
illustrated in Fig. [T]with two intensity settings. The signal 
state p is given by Eq. pip , and a is a vacuum state. We con- 
sider two possible scenarios: (A) A perfect threshold detector, 
i.e., e = and r) A = 1, and (B) e = 3.2 x 10~ 7 and r? d = 0.12 
[25j . Both cases provide approximately the same final key 
rate and they cannot be distinguished with the resolution of 
this figure (dashed line). The solid line represents a lower 
bound on R when Alice employs a PNR detector instead of a 
threshold detector (see Appendix IB 1[) . 



that q = 1, and f(E c ) = f(E s ) = 1.22. These data 
are used as well for simulation purposes in the following 
sections. We study two different scenarios: (A) A per- 
fect threshold detector, i.e., e = and r]d = 1, and (B) 
e = 3.2 x 10~ 7 and r] d = 0.12 [Hj]. In both cases we 
find that the values of the mean photon number \i and 
the transmittance t which maximize the secret key rate 
formula are quite similar and almost constant with the 
distance. In particular, [i is quite strong (around 200 
in the simulation), while t is quite weak (around 10 -3 ). 
This result is not surprising. When fi S> 1 and f « 1, 
Alice's threshold detector produces a click most of the 
times. Then, in the few occasions where Alice actually 
does not see a click in her measurement device, she can 
be quite confident that the signal state that goes to Bob 
is quite weak. Note that in this scenario the conditional 
photon number statistics satisfy q$ « 1 and q^ l>1 ~ 0. 
Similarly to the one weak decoy state protocol proposed 
in Ref. [12[, this fact allows Alice and Bob to obtain an 
accurate estimation of Y\ and e\, which results into an 
enhancement of the achievable secret key rate and dis- 
tance. The cutoff point where the secret key rate drops 
down to zero is I w 126 km. 

One can improve the resulting secret key rate further 
by using a passive scheme with more intensity settings. 
For instance, Alice may employ a PNR detector instead 
of a threshold detector, or she could use several thresh- 
old detectors in combination with beam splitters. In this 
context, see also Ref. [lj|. Figure [3] illustrates also this 
last scenario, for the case where Alice uses a PNR de- 
tector (solid line). As expected, it turns out that now 
the legitimate users can estimate the actual value of the 
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relevant parameters Yq, Y\, and ei with arbitrary pre- 
cision (see Appendix IB The cutoff point where the 
secret key rate drops down to zero is I ss 147 km. This 
result shows that the performance of the passive setup 
represented in Fig. Q] with a threshold detector is already 
close to the best performance that can be achieved at all 
with such an scheme and the security analysis provided 
in Rcfs. SH. 



VI. WEAK COHERENT LIGHT 

Suppose now that the signal states p and a which ap- 
pear in Fig. [1] are two phase randomized WCP emitted 
by a pulsed laser source. That is, 



n=0 



(20) 



with pi and p 2 denoting, respectively, the mean photon 
number of the two signals. In this scenario, the joint 
probability of having n photons in output mode a and m 
photons in output mode b can be written as [l8[ 
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FIG. 4: Conditional photon number distribution in mode a 
(see Fig.rjJ: g£ (black) versus q£ (grey) when the signal states 
p and a are two phase randomized WCP given by Eq. (|20|l . 
We consider that pi = p2 — 1 and t = 1/2, and we study 
two situations: (A) A perfect threshold photon detector, i.e., 
e = and r) d = 1 [3, and (B) e = 3.2 x 1CT 7 and rj d = 0.12. 
These last data correspond to the experiment reported by 
Cobby et al. in Ref. [25||. Cases C and D represent qjj (black) 
versus a Poissonian distribution of the same mean photon 
number for the two scenarios described above (perfect and 
imperfect threshold photon detector). 



Pn 



7 "(l- 7 rd0, (21) 



n\m\ 2tt J q 
where the parameters v, 7, and £, are given by 

v = Mi + M2, 

Pit + p 2 (l —t) + £cos6> 
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e = 2^1^2(1-^. 



(22) 



This result differs from the one expected from the in- 
terference of two pure coherent states with fixed phase 
relation, l^/pie^ 1 ) and \y/p2e 1 ^ 2 }, at a BS of transmit- 
tance t. In this last case, p n ,m is just the product of two 
Poissonian distributions. Whenever Alice ignores the re- 
sult of her measurement in mode 6, then the probability 
of finding n photons in mode a can be expressed as 



m=0 



^e-^dO, (23) 



which turns out to be a non-Poissonian probability dis- 
tribution [ID]. Let us now consider the case where Alice 
uses a threshold detector to measure output mode b. 



seeing n photons in mode a and no click in the threshold 
detector has now the form 



00 



Pn = (l-e)^(l-77 d )>, 

m=0 

v n e- VdV 1 



(24) 



(1-e)- 



2- 



2^ 



7 ' l e - (1 - T ' d)l ' 7 d6». 



On the other hand, if the detector produces a click, the 
joint probability of finding n photons in mode a is given 
by Eq. (fl7)) . Figure [4] (Cases A and B) shows the con- 
ditional photon number statistics of the outcome signal 
in mode a depending on the result of the detector (click 
and no click): q c n = p c n /{l — N w ) and = p c n /N w , with 



= 5>» = (1- e)e-^ 1 - t ^I , ld ^ (25) 

and where I q ^ z represents the modified Bcssel function of 
the first kind 1261. This function is defined as [26fl 



Iq z = ^-<p e W 2 X i+1 ' t k-*- 1 dt. (26) 



A. Threshold detector 

The analysis is completely analogous to the one pre- 
sented in Sec. IV Al In particular, the joint probability for 



Figure [4] includes as well a comparison between and a 
Poissonian distribution of the same mean photon number 
(Cases C and D). Both distributions, q^ and are also 
non-Poissonian. 
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B. Lower bound on the secret key rate 

To apply the secret key rate formula given by Eq. (O, 
with I G {c, c}, we need to estimate the quantities Y , 
Yi, and e\. For that, we follow the same procedure ex- 
plained in Appendix [A] This method requires that p l n 
and p c n satisfy certain conditions that we confirmed nu- 
merically. As a result, it turns out that the bounds given 
by Eqs. (|A10[) - (|A16|) are also valid in this scenario. 

The only relevant statistics to evaluate Eqs. (|A10j) - 
(|A16j) are p l n and p c n , with n = 0,1,2. These proba- 
bilities can be obtained by solving Eqs. (j23|) -(f24 |) . They 
are given in Appendix [C] Note that p c n can be directly 
calculated from these two statistics by means of Eq. (fT7|) . 
After substituting Eqs. ©-([H]) into the gain and QBER 
formulas we obtain 

Q s = N w -{l-e)(l-Y )eS^s ye )u>~ Vd v 

X A).(>)d-*y 3 )?' 

Q 5 E 5 = (eo - e d )Y N w + e d Q £ , 

Q* = 1 - (1 - Y )e^ u I QtVmM , 
Q t E t = (e - e d )Y + e d Q\ (27) 

with the parameter to given by 

w = int + iMi(l-t). (28) 

The resulting lower bound on the secret key rate is il- 
lustrated in Fig. [5] We assume that t = 1/2, i.e., we 
consider a simple 50 : 50 BS. Again, we study two dif- 
ferent situations: (A) e = and ru = 1 and (B) 
e = 3.2 x 10~ 7 and rja = 0.12 [25j |. In both cases the 
optimal values of the intensities /i! and (12 arc almost 
constant with the distance. One of them is quite weak 
(around 10 -4 ), while the other one is around 0.5. The 
reason for this result can be understood as follows. When 
the intensity of one of the signals is really weak, the out- 
put photon number distributions in mode a are always 
close to a Poissonian distribution (for click and no click 
events). This distribution is narrower than the one aris- 
ing when both [i\ and /X2 are of the same order of mag- 
nitude. In this case, a better estimation of Y± and e\ 
can be derived, and this fact translates into a higher se- 
cret key rate. It must be emphasized, however, that from 
an experimental point of view this solution might not be 
optimal. Specially, since in this scenario the two output 
distributions p^ and p c n might be too close to each other 
for being distinguished in practice. This effect could be 
specially relevant when one considers statistical fluctua- 
tions due to finite data size (see Sec. IVIIll . For instance, 
small fluctuations in a practical system could overwhelm 
the tiny difference between the decoy state and the sig- 
nal state in this case. Figure [5] includes as well the secret 
key rate of an active asymptotic decoy state QKD system 
with infinite decoy settings ■ The cutoff points where 
the secret key rate drops down to zero are i w 128 km 
(passive setup with two intensity settings) and I w 147 
km (active asymptotic setup) . From these results we see 




Fiber link [km] 

FIG. 5: Lower bound on the secret key rate R given by Eq. @ 
in logarithmic scale for the passive decoy state setup illus- 
trated in Fig. [T] with two intensity settings. The signal states 
p and a are two phase randomized WCP given by Eq. (|20[1 . 
The transmittance of the BS is t — 1/2. We consider two 
possible scenarios: (A) e = and rj^ = 1 [JJI (i.e., a per- 
fect threshold photon detector), and (B) e = 3.2 x 10~ 7 and 
?7d = 0.12 [25|]. Both cases provide approximately the same 
final key rate and they cannot be distinguished with the res- 
olution of this figure (dashed line). The solid line represents 
a lower bound on R for an active asymptotic decoy state sys- 
tem with infinite decoy settings [l(| . This last result coincides 
approximately with the case where Alice employs a PNR de- 
tector (see Appendix IB 2|l , and the secret key rate is both 
scenarios cannot be distinguished with the resolution of this 
figure. 



that the performance of the passive scheme with a thresh- 
old detector is comparable to the active one, thus showing 
the practical interest of the passive setup. 

Like in Scc.fVl one can improve the performance of the 
passive scheme further by using more intensity settings. 
The case where Alice uses a PNR detector is analyzed in 
Appendix IB 21 The result is also shown in Fig. [5] It re- 
produces approximately the behavior of the asymptotic 
active setup and the secret key rate is both scenarios 
cannot be distinguished with the resolution of this figure 
(solid line). This result is not surprising, since in both 
situations (passive and active) we apply Eq. J5|) with the 
actual values of the parameters Yq, Yi, and e\. The only 
difference between these two setups arises from the pho- 
ton number distribution of the signal states that go to 
Bob. In particular, while in the passive scheme the rele- 
vant statistics are given by Eq. (|B9|) . in the active setup 
these statistics have the form given by Eq. (|B12|) . 



C. Alternative implementation scheme 

The passive setup illustrated in Fig. Q] requires that 
Alice employs two independent sources of signal states. 
This fact might become specially relevant when she uses 
phase randomized WCP, since in this situation none of 
the signal states entering the BS can be the vacuum state. 



8 



BS 



BS 



IM 



O 

* ou 



t, 

I vacuum) 



Photo-detector 



a 



|vacuum) 



P- 



, BS __ 



BS 



y Classical threshold 
detector 



FIG. 6: Alternative implementation scheme with only one 
pulsed laser source. The delay introduced by one arm of the 
interferometer is equal to the time difference between two 
pulses. The intensity modulator (IM) blocks either all the 
even or all the odd optical pulses in mode a. 



FIG. 7: Basic setup of a passive decoy state QKD scheme 
with strong coherent light. The mean photon number of the 
signal states p and a is now quite high; for instance, around 
~ 10 8 photons, ti and ti represent the transmittances of the 
two BS, and a, b, and c denote output modes. 



Otherwise, the photon number distributions of the out- 
put signals in mode a and mode b would be statistically 
independent. 

Alternatively to the passive scheme shown in Fig. [1] 
Alice could as well employ, for instance, the scheme il- 
lustrated in Fig. [5] This setup has only one laser diode, 
but follows a similar spirit like the original scheme in 
Fig. [TJ where a photo-detector is used to measure the 
output signals in mode b. It includes, however, an in- 
tensity modulator (IM) to block either all the even or 
all the odd pulses in mode a. This requires, therefore, 
an active control of the functioning of the IM, but note 
that no random number generator is needed here. The 
main reason for blocking half of the pulses in mode a 
is to suppress possible correlations between them. That 
is, the action of the IM guarantees that the signal states 
that go to Bob are tensor product of mixtures of Fock 
states. Then, one can directly apply the security analy- 
sis provided in Rcfs. [1, [HI H3] . Thanks to the one-pulse 
delay introduced by one arm of the interferometer, to- 
gether with a proper selection of the transmittance t\ , it 
can be shown that both setups in Fig. [T] and Fig. [5] are 
completely equivalent, except from the resulting secret 
key rate. More precisely, the secret key rate in the active 
scheme is half the one of the passive setup, since half of 
the pulses are now discarded. 



VII. STRONG COHERENT LIGHT 

Let us now consider the passive decoy state setup il- 
lustrated in Fig. [JJ This scheme presents two main dif- 
ferences with respect to the passive system analyzed in 
Sec. I VII In particular, the mean photon number (inten- 
sity) of the signal states p and a is now very high; for 
instance, « 10 8 photons. This fact allows Alice to use 
a simple classical photo-detector to measure the pulses 
in mode 6, which makes this scheme specially suited for 
experimental implementations. Moreover, it has an ad- 
ditional BS of transmittance ti to attenuate the signal 
states in mode a and bring them to the QKD regimen. 

Due to the high intensity of the input signal states p 
and a, we can describe the action of the first BS in Fig.[7J 



by means of a classical model. Specifically, let I\ (I2) 
represent the intensity of the input states p (a), and let 
I a (9) [h{9)\ be the intensity of the output pulses in mode 
a (b). Here the angle 9 is just a function of the relative 
phase between the two input states. It is given by 

9 = </>i - <t>i + jt/2, (29) 

where 0i (02 ) denotes the phase of the signal p (a). 
Like in Sec. IVI1 we assume that these phases are uni- 
formly distributed between and 2tt for each pair of in- 
put states. This can be achieved, for instance, if Alice 
uses two pulsed laser sources to prepare the signals p and 
a. With this notation, we have that I a (9) and h(9) can 
be expressed as 

I a {9) = hh + nh + 2^/hriIih cos 6, 

I b {9) = rih + hl 2 - 2y/t 1 r 1 I 1 I 3 cos0, (30) 

where t\ denotes the transmittance of the BS, and n = 
l-ti. 



A. Classical threshold detector 

For simplicity, we shall consider that Alice uses a per- 
fect classical threshold detector to measure the pulses in 
mode b. For each incoming signal, this device tells her 
whether its intensity is below or above a certain thresh- 
old value I M that satisfies h(^) > Im > -4(0). That 
is, the value of Im is between the minimal and maximal 
possible values of the intensity of the pulses in mode b. 
Note, however, that the analysis presented in this section 
can be straightforwardly adapted to cover also the case 
of an imperfect classical threshold detector, or a classical 
photo-detector with several threshold settings. Figure [5] 
shows a graphical representation of h{9) versus the angle 
9, together with the threshold value Im- The angle 8^ 
which satisfies lb (9th) = Im is given by 

/ rih +hl 2 - Im\ / Q1> 
th = arccos — — . (31) 



Ib(lt) 




l b (0) 



FIG. 8: Graphical representation of the intensity h(8) in 
mode b (see Fig. [TJl versus the angle 0. Im represents the 
threshold value of the classical threshold detector, and 8 t h is 
its associated threshold angle. 
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Whenever the classical threshold detector provides Al- 
ice with an intensity value below Im , it turns out that the 
unnormalized signal states in mode c can be expressed as 



<Im 
Pout 



1 ^ f /-fith e -^(0)* 2 [/ a (0)t 2 ]« 




n)(n\dO 



n) (n\d9 



'27r-e th 



-E / ! ^^L\n){n\de. (32) 



This means, in particular, that the joint probability of 
finding n photons in mode c and an intensity value below 
Im in mode b is given by 

Pn lM = -?- / UOTe-^o^de. (33) 

Similarly, we find that p„ M can be written as 

Pn lM = -?- / I a {Q) n e- Ia[e)t2 d6. (34) 

Figure [5] (Case A) shows the conditional photon number 
statistics of the outcome signal in mode c depending on 
the result of the classical threshold detector (below or 
above 7 M ): qf M = P% Im /N, and q> lM = p>* M /{1-N B ), 
with 



£ J STT- 



(35) 



n=0 



This figure includes as well a comparison between q< Im 
(Case B) and q„ lM (Case C) and a Poissonian distribu- 
tion of the same mean photon number. It turns out that 
both distributions, q^ lM and q^ lM , approach a Poisso- 
nian distribution when ti is sufficiently small. 



FIG. 9: (A) Conditional photon number distribution in mode 
c (see Fig. [7J: q„ lM (black) and q^ lM (grey) for the case 
7i = I 2 = hi = 10 8 , ti = 1/2, and t 2 = 0.5 x 1(T 8 . Cases B 
and C represent, respectively, 7m and q„ ' M (black) versus 
a Poissonian distribution of the same mean photon number 
(grey). 



B. Lower bound on the secret key rate 

Again, to apply the secret key rate formula given by 
Eq. ((U), with I G {< Im, > Im}, we need to estimate the 
quantities Yo,Y±, and e\. Once more, we follow the pro- 
cedure explained in Appendix [X] We confirmed numer- 
ically that the probabilities p„ Im and p„ Im satisfy the 
conditions required to use this technique. As a result, it 
turns out that the bounds given by Eqs. (|A10[) - (|A16[) are 
also valid in this scenario. 

For simplicity, we impose I\ — I2 — Im = !• This 
means that 9th = n/2. The relevant statistics p^ 1m and 
P^ Im , with n = 0,1,2, are calculated in Appendix ITU 
After substituting Eqs. ©-J!]) into the gain and QBER 
formulas we obtain 



q<Im E <Im 

Q >Im = (1-JV,)- 



(1 - Y )e~ Vs y sK 



(eo - e d )Y Q N s + e d Q <h ' , 
(1 - Yo)e~ rfeysK 



x (Jo.fhysf + I'O.Tfey.c)) 
q>Im E >Im = (e -e d )Y (l-N s ) + e d Q >h 

where the parameter k is given by 

K = Ito, 



(36) 



(37) 



and hq^z represents the modified Struve function [271 ] de- 
fined by Eq. (jD2)) . 

The resulting lower bound on the secret key rate is il- 
lustrated in Fig. [TUJ We study two different situations: 
(A) We impose t\ = 1/2, i.e., we consider a simple 50 : 50 
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FIG. 10: Lower bound on the secret key rate R given by 
Eq. in logarithmic scale for the passive decoy state setup 
illustrated in Fig. [7] with two intensity settings. We consider 
two possible scenarios: (A) We impose ti = 1/2, i.e., we 
consider a simple 50 : 50 BS, and we optimize the parameter 
K (dashed line), and (B) we optimize both parameters, t\ and 
k (solid line). 
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FIG. 11: Alternative implementation scheme with only one 
pulsed laser source. The delay introduced by one arm of the 
interferometer is equal to the time difference between two 
pulses. The intensity modulator (IM) blocks either the even 
or the odd optical pulses in mode c. 



BS, and we optimize the parameter At, and (B) we opti- 
mize both quantities, t\ and k. In both scenarios the op- 
timal values of the parameters are almost constant with 
the distance. In the first case k is around 0.2, while in 
the second case wc obtain that t± and k are, respectively, 
around 0.06 and 0.25. The cutoff point where the secret 
key rate drops down to zero is I « 132 km both in case 
A and B. These results seem to indicate that this passive 
scheme can offer a better performance than the passive 
setups analyzed in Sec.lVland in Sec.[VT]with a threshold 
photon detector. This fact arises mainly from the prob- 
ability distributions p^ 1 " and p^ 1 " , which, in this sce- 
nario, approach a Poissonian distribution when ti is suf- 
ficiently small. Again, one can improve the performance 
of this system even further just by using more threshold 
settings in the classical threshold detector. Moreover, 
from an experimental point of view, this configutation 
might be more feasible than using PNR detectors. 

To conclude this section, let us mention that, like in 
Sec. I VI Cl Alice could as well employ, for instance, the al- 
ternative active scheme illustrated in Fig. 1111 This setup 



has only one pulsed laser source, but includes an intensity 
modulator (IM) to block either all the even or all the odd 
pulses in mode c. The argumentation here goes exactly 
the same like in Sec. IVI CI and we omit it for simplicity. 
The resulting secret key rate in the active scheme is half 
the one of the passive setup. 



VIII. STATISTICAL FLUCTUATIONS 

In this section, we discuss briefly the effect that finite 
data size in real life experiments might have on the final 
secret key rate. For that, we follow the statistical fluc- 
tuation analysis presented in Ref. fl2| . This procedure 
is based on standard error analysis. That is, we shall 
assume that all the variables which are measured in the 
experiment each fluctuates around its asymptotic value. 

Our main objective here is to obtain a lower bound 
on the secret key rate formula given by Eq. ^ under 
statistical fluctuations. For that, we realize the following 
four assumptions: 

1. Alice and Bob know the photon number statistics 
of the source well and we do not consider their fluc- 
tuations directly. Intuitively speaking, these fluc- 
tuations are included in the parameters measuring 
the gains and QBERs. 

2. Alice and Bob use a real upper bound on the sin- 
gle photon error rate e±, thus no fluctuations have 
to be considered for this parameter. In particular, 
we use the fact that the number of errors within 
the single photon states cannot be greater than the 
total number of errors. 

3. Alice and Bob use a standard error analysis proce- 
dure to deal with the fluctuations of the variables 
which are measured. 

4. The error rate of background does not fluctuate, 
i.e., e = 1/2. 

To illustrate our results, we focus on the passive decoy 
state setup introduced in Sec. EU Note, however, that a 
similar analysis can also be applied to the other passive 
schemes presented in this paper. 



A. Active decoy state QKD 

In order to make a fair comparison between the active 
and the passive decoy state QKD setups with two inten- 
sity settings, from now on we shall consider an active 
scheme with only one decoy state [l2j]. In this last case, 
the quantities Y\ and e\ can be bounded as 



l _ t* 2 Q»e v ~ v 2 Q^ - (ji 2 - v 2 )Y 



ei < e 1 



E^Q^ - e Y Q 
Yin 



(38) 
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where fi (y) denotes the mean photon number of a signal 
(decoy) state, Q M {Q v ) and (E„) represent, respec- 
tively, its associated gain and QBER, and Yq is a free pa- 
rameter. Using the channel model described in Sec. IIII1 
we find that these parameters can be written as 



Q» = Y + l-e-^% 
E ft Q^ = e Y + e d {l-e-^), 

Q v = Y + l-e-^% 
E V Q V = e Y + e d (l - e"^). 



(39) 



If we now apply a standard error analysis to these quan- 
tities we obtain that their deviations from the theoretical 
values are given by 



Aq„ = U a yJ Q v /N v , 



Aq p _e m = u a J2E ll Q fJi /N fJi 



(40) 



A 



QvEv 



u a ^2E v Q v jN Vl 



where (N v ) denotes the number of signal (weak de- 
coy) pulses sent by Alice, and u a represents the number 
standard deviations from the central values. That is, 
the total number of pulses emitted by the source is just 
given by N = + N v . Roughly speaking, this means, 
for instance, that the gain of the signal states lies in the 
interval ± Aq m except with small probability, and 
similarly for the other quantities defined in Eq. ([ST)]) . For 
example, if we select u a = 10, then the corresponding 
confidence interval is 1 — 1.5 x 10 -23 , which we use later 
on for simulation purposes. For simplicity, here we have 
assumed that Alice and Bob use the standard BB84 pro- 
tocol, i.e., they keep only half of their raw bits (due to 
the basis sift). This is the reason for the factor 2 which 
appears in the last two expressions of Eq. (|4"0")) . In this 
context, see also Ref. [28| for a discussion on the optimal 
value of the parameter q. 



B. The background Yq 



The bounds given by Eq. (|38[) depend on the unknown 
parameter Y . When a vacuum decoy state is applied, the 
value of Yq can be estimated. Alternatively, one can also 
derive a lower bound on Y\ and an upper bound on ei 
which do not depend on Yq. Specifically, from Eqs. 
([3]) we obtain that 



(1 - 2e 1 )Y 1 > A 



/' 



v(n - v) 
v 

H(H - v) 



Q v {l-2E v )e v 
Q /i {l-2E^. (41) 



The gains and Q u , together with the QBERs E^ and 
E u , arc directly measured in the experiment, and their 



statistical fluctuations are given by Eq. (|40|) . On the 
other hand, we have that 



d < 



B 



with the parameter B given by 

' ' E v Q v e v E^Q^-Ev 



B = min 



V /! — V 

Combining Eqs. flH])-((25]) we find 



Y 1 [l-H{e 1 )} > 



A 



1 - 2ei 



l-H 



fl(l-2ei) 



(42) 



(43) 



(44) 



The quantities A and B can be obtained directly from 
the variables measured in the experiment. Moreover, if 
one considers the secret key rate formula given by Eq. ([5]) 
as a function of the free parameter e±, then one should 
select an upper bound on e\, which gives a value (may 
not be a bound) for Y\ as 



A + 2B, 
B 

A + 2B' 



(45) 



where the equation for comes from solving the two 
inequalities given by Eqs. (|4Tj) - (|4"2)) . 

Again, using a standard error analysis procedure, we 
find that the deviations of the parameters A and B from 
their theoretical values can be written as 

(ciA Ql/ ) 2 + 4(c 1 A £ ; i , Q „) 2 + (c 2 A Qm ) 2 

1 

+4(c 2 A £aiQai ) 2 ] 2 , 



EvQv) 



fl — V 

where the coefficients c± and c 2 have the form 



(46) 



ci 



C2 = 



v(n - v) 
v 



(47) 



and the deviations of the gains and the QBERs are given 
by Eq. 0D]). 

For simplicity, we assume now that A and B are sta- 
tistically independent. Thus, the statistical deviation of 
the crucial term Yi[l — i/ 2 (ei)] in the secret key formula 
can be written as 



i Yl [l-H 2 {e 1 )] 




(48) 
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FIG. 12: Lower bound on the secret key rate R given by 
Eq. in logarithmic scale. We consider four possible sce- 
narios: (A) An active decoy state setup (with only one decoy 
state) with statistical fluctuations (dashed line) [12|l> (B) An 
active decoy state setup (with only one decoy state) with- 
out considering statistical fluctuations (thick solid line) [l2T |. 
(C) The passive decoy state scheme with WCP introduced in 
Sec. IVII now considering statistical fluctuations. In this last 
case, moreover, we study two possible situations depending 
on the value of ?7d: (CI) r/d — 1 (thin solid line), and (C2) 
?7d = 0.4 (dash-dotted line). (D) The passive decoy state 
scheme with WCP introduced in Sec. IVII with r]d = 1 and 
without considering statistical fluctuations (dotted line). In 
all passive setups the transmittance of the BS is t = 1/2 and 
we use e = 0. Furthermore, we pick the data size (total num- 
ber of pulses emitted by Alice) to be N — 6 x 10 9 . The 
confidence interval for statistical fluctuations is ten standard 



deviations (i.e., 1 — 1.5 x 10 



From Eqs. (|40[) . (f4"6"|) and (|4"5)l one can directly calculate 
the final secret key rate with statistical fluctuations for 
an active decoy state setup with only one decoy state [e| • 
The result is illustrated in Fig. [T2"l (dashed line). Here we 
use again the experimental data reported by Gobby et 
al. in Ref. [25| . Moreover, we pick the data size (total 
number of pulses emitted by Alice) to be N — 6 x 10 9 . 
We calculate the optimal values of (i and v for each fiber 
length numerically. It turns out that both parameters 
are almost constant with the distance. One of them is 
weak (it varies between 0.03 and 0.06), while the other 
is around 0.48. This figure includes as well the result- 
ing secret key rate for the same setup without consider- 
ing statistical fluctuations (thick solid line). The cutoff 
points where the secret key rate drops down to zero are 
I « 129.5 km (active setup with statistical fluctuations) 
and / w 147 km (active setup without considering sta- 
tistical fluctuations). From these results we see that the 
performance of this active scheme is quite robust against 
statistical fluctuations. 



C. Passive decoy state QKD 

The analysis is completely analogous to the previous 
section. Specifically, we find that the parameters A and 
B are now given by 



.4 



p cQ t (l-2E t )-p t 2 Q s (l-2E 5 ) 



B = mm^,^fc4^1, (49) 



Pi 



P%Pi - PoPi 



while Eq. (f4"5"|) is still valid in this scenario. The devia- 
tions of A and B have the form 



1 



(^A Qt ) 2 + 4(^A £tQt ) 2 



Ar = 



+ (?4Aq,) 2 + 4(p|A E a Q e 



Pi 



Pi 



^{pl& EtQt y + {pl& E , Q ,y 

pIp\ - P%Pi 



(50) 



On the other hand, the deviations of the gains and the 
QBERs can now be written as 



A Q t = Uay/Qt/N, 

A Q a = u ay /Q e /N e , 

u a ^2E t Q t /N, 
u aV / 2E e Q s /N e , 



A^cQ 



(51) 



where N c denotes the number of pulses where Alice ob- 
tained no click in her threshold detector, and N is the 
total number of pulses emitted by the source. The devia- 
tion of the term Yi[l — Hi{e\j\ is again given by Eq. (|48|) . 

The secret key rate for the passive decoy state scheme 
with WCP introduced in Sec. IVII with two intensity set- 
tings and considering statistical fluctuations is illustrated 
in Fig. [T^J We assume that t = 1/2, i.e., we consider a 
simple 50 : 50 BS, and e = 0. The data size is equal to 
the one of the previous section, i.e., N = 6 x 10 9 . We 
study two different situations depending on the efficiency 
of Alice's threshold detector: rjd = 1 (thin solid line), and 
r]d = 0.4 (dash-dotted line). In both cases the optimal 
values of the intensities fii and ^t 2 ar c almost constant 
with the distance. One of them is weak (it varies between 
0.1 and 0.17), while the other is around 0.5. Figure [T2l 
includes as well the resulting secret key rate for the same 
setup with r]d = 1 and without considering statistical 
fluctuations (dotted line). The cutoff points where the 
secret key rate drops down to zero are I w 53 km (pas- 
sive setup with statistical fluctuations and -q^ = 0.4), 
I ?s 80 km (passive setup with statistical fluctuations 
and rjd — 1), and i w 128 km (passive setup without 
considering statistical fluctuations, see Sec. IVI|) . From 
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these results we see that the performance of the passive 
schemes introduced in Sec. IVII (with statistical fluctua- 
tions) depends on the actual value of the efficiency rj^. 
In particular, when Alice's detector efficiency is low, the 
photon number statistics of the signal states that go to 
Bob (conditioned on Alice's detection) become close to 
each other. This effect becomes specially relevant when 
one considers statistical fluctuations due to finite data 
size. In this last case, small fluctuations can easily cover 
the difference between the signal states associated, re- 
spectively, to click and no click events on Alice's thresh- 
old detector. As a result, the achievable secret key rate 
and distance decrease. 



APPENDIX A: ESTIMATION PROCEDURE 

Our starting point is the secret key rate formula given 
by Eq. (|5|). This expression can be lower bounded by 



R l > q{-Q l f{E l )H{E l ) 
x [1-H{t%)]}, 



( P [Y 1+ p l Y ) 



(Al) 



where ey denotes an upper bound on the single photon 
error rate ey. Hence, for our purposes it is enough to 
obtain a lower bound on the quantities p\Yy + PqYq for 
all /, together with ey . For that, we follow the esti- 
mation procedure proposed in Ref. Next, we show 
the explicit calculations for the case where Alice uses the 
passive scheme introduced in Sec. [V] 



IX. CONCLUSION 



1. Lower bound on pyYy + p l Q Yo 



In this paper we have extended the results presented in 
Ref. [IH, now showing specifically the analysis for other 
practical scenarios with different light sources and photo- 
dctcctors. In particular, we have considered sources 
emitting thermal states and phase randomized WCP in 
combination with threshold detectors and photon num- 
ber resolving (PNR) detectors. In the case of threshold 
detectors, we have included as well the effect that de- 
tection inefficiencies and dark counts present in current 
measurement devices might have on the final secret ket 
rate. For simplicity, these measurement imperfections 
were not considered in the original proposal. On the 
other hand, PNR detectors have allowed us to obtain ul- 
timate lower bounds on the maximal performance that 
can be expected at all from this kind of passive setups. 
We have also presented a passive scheme that employs 
strong coherent light and does not require the use of sin- 
gle photon detectors, but it can operate with a simpler 
classical photo-detector. This fact makes this setup spe- 
cially interesting from an experimental point of view. Fi- 
nally, we have provided an estimation on the effects that 
statistical fluctuations due to a finite data size can have 
in practical implementations. 



The method contains two main steps. First, we have 
that p\Yy + p l Y always satisfies 



Pl Yy+p l Y >pyYy L +p l Y , 



(A2) 



for all I € {c, c}, and where Yy denotes a lower bound 
on the yield of a single photon state. To find Yy , note 
that 



n=0 
1 

< T,(P2Pn~P2P t n)Yn, (A3) 



since 



PlPn PlPn ~ 



n+2 



\ r n- 



[(1 + M*)rf 



(i + f ity 



(A4) 



for all n > 2, and where the parameter r is given by 
Eq. (fTo| . To see this, note that the first term on the r.h.s. 
of Eq. (|A4[) is always greater or equal than zero, and 
T > l + p.t> 1. Similarly, we have that p\p c n — P2Pn — 
for all n < 1. Combining both results, we obtain 
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Yy > Yy = max ^ e -^-(^ -^)y 

( VlPi ~ PWi J 

(A5) 

Now comes the second step. The term which multiplies 
Yq in the expression p\ Yy + p 1 Yq satisfies 



i p\pI-pIpI i < 

Pi FT + Po u - 

P2P1 ~ PWi 



(A6) 



This last statement can be proven as follows. The condi- 
tion given by Eq. (|A6[) is equivalent to 

MpI - pIp\) < P l MPo ~ (A7) 
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since, as we have seen above, — P2P1 — 0- After 
a short calculation, it turns out that Eq. (|A7[) can be 
further simplified to 



t c c t \ n 

PxPo - PxPo > 0, 



(A8) 



both for I = c and I = c. Finally, from the definition of 
the probabilities p l n and p c n given by Eqs. (flU)) - (fl"5|) , we 
find that 



t c c t 

PlPn ~ PlPn 



n+1 



[(1+M*>f 
( 1 1 



r-n— 1 



(1 + pt) 



n-X 



(A9) 



which is greater or equal than zero for all n < 1, and 
negative otherwise. Note that the first term on the r.h.s. 
of Eq. (|A9[) is always greater or equal than zero, and the 
sign of the second term depends on the value of n, since 
r > 1 + fit > 1. 

We obtain, therefore, that 



PiPq)Y^], where Yy is given by Eq. (|A5|) with the pa- 
rameter Yq replaced by Y U . 

On the other hand, note that Eq.® also provides a 
simple upper bound on ex- Specifically, 

00 

Q C E C = Y,PnYne n > p^Yoev + p^Yxd, (A15) 

and similarly for the product Q C E C . Putting all these 
conditions together, we find that 

, u . \ E c Q c -p c Q Y L e E s Q E ~p-Y L e 
e 1 <e 1 = mm <J — ^ , 



p\Yx L P\Yx L 



plE'Q 1 - p £ £ Q e 

(ApI-pM)Yi 



(Ai6) 



where Yq represents a lower bound on the background 
rate Yg. To calculate this parameter we use the following 
inequality: 



P [Y 1+ p% > max \ P ^}f ~ (A10) 

PlPx - PWx 



1 j, p\pI-pIpo 

Po Pi t 5 e~T 
P2P1 ~ PWx 



Yn u ,0l 



for all I G {c, c}, and where Yq denotes an upper bound 
on the background rate Y . This parameter can be cal- 
culated from Eq.Q. In particular, we have that 

00 

Q C E C = Y^P c n Y n e n > p c Y e Q , (All) 

71=0 

and similarly for the product Q C E C . We find 

f E C Q C E £ Q 5 \ 



Y n < Y? 



(A12) 



2. Upper bound on ei 

For this, we proceed as follows: 

00 

p^E'-plQ'E 5 = J2(PnPo-P 5 nPo)Y n e n 

n=X 

> (pIpl-plpDYxex, (A13) 
where the inequality condition comes from the fact that 



PnP0 PnPo - (1 + ^y ^ + ^ ) >», 

(A14) 

for all n > 1. From Eq. (fAT3|) we obtain, therefore, 
that ei is upper bounded by (pqE^ 1 ~p t Q E c Q c )/[(p\pf ) — 



p[Q 5 - p\Q l = (ApI - pIpI)y + £ (p\pI - pbDYn 



< [p\p c Q -plpl)Y Q 



(A17) 



since, as we have seen above, p\p c n — PxPn — - f° r an 
n > 2. From Eq. (|A17[) we obtain, therefore, that 



' y p\po - pIpI 



,0 



(Ais) 



APPENDIX B: PNR DETECTOR 

In this Appendix we study the case where Alice uses 
a perfect PNR detector to measure the signal states in 
mode b. The main goal of this analysis is to obtain an 
ultimate lower bound on the secret key rate that can 
be achieved at all with the passive decoy state setups 
introduced in Sec. [V] and Sec. IVI1 in combination with 
the security analysis provided in Refs. [s1.[20|. 

A perfect PNR detector can be characterized by a 
POVM which contains an infinite number of elements, 



F„ 



\m) (m|, 



(Bl) 



with 771 = 0,1,..., 00. The outcome of F m corresponds 
to the detection of m photons in mode b. 



1. Thermal light 

Let us begin by considering the passive scheme ana- 
lyzed in Sec. [V] with Alice using a PNR detector. When- 
ever she finds m photons in mode 6, then the joint prob- 
ability distribution of having n photons in mode a is just 
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Photon number 



■ , 

□ Pn 

□ Pi 



Photon number 



FIG. 13: Conditional photon number distribution in mode a 
when Alice uses a PNR detector, p is given by Eq. (|ll|l . and 
a is a vacuum state: p° (black), pj, (grey), and (white). 
We consider that p = 1, t = 1/2, and n < 5. 



FIG. 14: Conditional photon number distribution in mode 
a when Alice uses a PNR detector: p° (black), p\ (grey), 
and (white). The signal states p and a in Fig. Q]are two 
phase randomized WCP given by Eq. (|20[) . We consider that 
pi = P2 ~ 1, t — 1/2, and n < 5. 



given by Eq. (fl"2")) . Figure [T3] shows the conditional pho- 
ton number statistics in mode a given that mode b con- 
tains exactly m photons: p™ = p n ,m/N m , with 



^ ' Pn,m 
n=0 



1 



1 + /i(l - t) 



i + n(i-t) 



(B2) 



In this scenario, it turns out that Alice and Bob can 
always estimate any finite number of yields Y n and error 
rates e n with arbitrary precision. In particular, they can 
obtain the actual values of the parameters Yq, Y\, and 
e\. To see this, let Q m denote the overall gain of the 
signal states sent to Bob when mode b contains exactly 
m photons, and let the parameters X m and V n be defined 
as 



A,, 



(1 + p) m+1 Q m 



pt 

l + p 



Yn- 



(B3) 



With this notation, and using the definition of p n ,m given 
by Eq. (fl"!?|) . we find that Eq. © can be rewritten as 



v„ 



(B4) 



In order to evaluate Eq. ([5]) we need to find the proba- 
bilities po,m and pi, m for all m. From Eq. ()12|) we have 
that these parameters can be expressed as 



P0,i 



(1+ M )™+!' 

(m + 1)£(1 -t) r 



1 



1 



m+1 



(B6) 



The resulting lower bound on the secret key rate is 
illustrated in Fig. [3] (solid line). The optimal values of the 
parameters p and t are quite constant with the distance. 
Specifically, in this figure we choose p around 18.5 and t 
around 0.02. 



2. Weak coherent light 

Let us now consider the passive scheme illustrated in 
Sec. I VII with Alice using a PNR detector. Whenever her 
detector finds m photons in mode 6, the joint probability 
distribution of having n photons in mode a is given by 
Eq. (|21[) . Figurc[l~4lshows the conditional photon number 
statistics in mode a given that mode b contains exactly 
m photons: p™ = p n ,m/N m , with 



That is, the coefficient matrix of the system of linear 
equations given by Eq. (|B4[) for all possible values of m 
is a symmetric Pascal matrix (29| . This matrix has de- 
terminant equal to one and, therefore, in principle can 
always be inverted [2^] . Then, from the knowledge of the 
coefficients V n , the legitimate users can directly obtain 
the values of the yields Y n by means of Eq. (|B3|) . A sim- 
ilar argument can also be used to show that Alice and 
Bob can obtain as well the values of e„. 

After substituting Eqs. ©-([H]) into the gain and QBER 
formulas we obtain 



(eo 



(i-Y )[p(i-t)r 
{l+Mti-a-^)*]}"^ 1 ' 

e d )Y N m + e d Q m . (B5) 



N„ 



^ Pn,m 
n=0 



v e 



1 



2tt 



(1 - 7) m e v m (B7) 



To show that the experimental observations associated 
to different outcomes of the PNR detector allow Alice and 
Bob to obtain the values of the parameters Yo, Yi, and e\ 
with arbitrary precision, one could follow the same pro- 
cedure explained in Appendix IB 11 That is, one could try 
to prove that the determinant of the coefficient matrices 
associated to the systems of linear equations given by 
Eqs. ©-© is different from zero also in this scenario. 
For simplicity, here we have confirmed this statement 
only numerically. 

After substituting Eqs. I©-© into the gain and QBER 



16 



formulas we obtain 



v e 



1 



Q m E r 



ml 2ir 

x (1 - 7 ) m e" 7 d0, 
= (eo - e d )Y N m - 



[1 - (1 - Y )e-^^} 



e d Q m . (B8) 



The relevant probabilities po,m and pi !m can be calcu- 
lated directly from Eq. ([2l]) , We find that 



1 — 771 



m £ 2 
" 7' ' (u- w) 2 



rl — m 



e -^ 2 (w-cj)' 



x 5 



1 



2F 

TO 



(B9) 



where the Gamma function T z is defined as [26j 

t^e^dt, (BIO) 



and where g(a,b,c, z) represents the hypergeometric 
function 1261 . This function is defined as 12611 



g{a,b,c,z) 



r h r,_ 



1 t b - 1 {l-t) c - b - 1 



b Jo 



(1 - tz) a 



dt. 



(Bll) 



In this case, the lower bound on the resulting secret 
key rate reproduces approximately the behavior of the 
asymptotic active decoy state setup illustrated in Fig. [5] 
(solid line). Here we have assumed again that t = 1/2. 
The values of the intensities fii and /12 which optimize 
the secret key rate formula are, respectively, « 10~ 4 and 
« 0.95. As already discussed in Sec. IVI| this result is 
not surprising since the only difference between both se- 
tups (passive and active) arises from the photon number 
probabilities of the signal states sent by Alice. While in 
the passive scheme the relevant statistics are given by 
Eq. (|B9|) . in the active setup they have the form 



Po,r 
Px,j 



e~ 



e 



Mm ) 



(B12) 



with fi m denoting the mean photon number of the signals 
associated to setting m. Still, it turns out that this dif- 
ference is not significant enough to be appreciated with 
the resolution of Fig. [5] when we optimize the parameters 
/ii and /i2- 



APPENDIX C: WEAK COHERENT LIGHT: 
PROBABILITIES pi AND p= 

In this Appendix we provide explicit expressions for 
the probabilities p* n and p c nl with n = 0, 1, 2, for the case 



of a passive decoy state setup with phase randomized 
WCP. After a short calculation, we find that 



Pi = 

Pi = Mo,« - £Ii,s)e~ u , 



pI 



2 I ,Z + (1 - 2w)CJi,£ + Z 2 h£ e~ w , (CI) 



with lo = \i\t + /i2(l — t). The probabilities p c n have the 
form 

Po = Tl 0,(l-r, d )t, 

Pi = r ( w/ o,(i-'M)e _ ^i,(i-^ d )e), 



P2 = 



(l-»7d)€ 



+ C 2 ^2,(l->)d)?}' 



+ 



1 



1 -r/d 



- 2lo 



^ / i,(i-')d)e 



(C2) 



where r = (1 - e ) e -[^+(i-')d)^. 



APPENDIX D: PROBABILITIES p< /ju AND p>' K 



In this Appendix we provide explicit expressions for 
the probabilities p„ Im and p„ M , with n = 0,1,2. For 
simplicity, we impose h = h = Im = I- After a short 
calculation, we obtain 



pf* 



P?* 



— (I 0X -L QX ), (Dl) 
1—{ K (I QX - Lo X ) - C(h X - L~ 1X )}, 

(l-2 K )(Ji, c -L_x, c ) + C(/2,c-i2,c)]}, 



where K = H2, C = 2ftV^rn~, and L q . z represents the 
modified Struve function [27| . This function is defined as 



Lq ' z 2«-^r q+1/2 J 



ir/2 



sinh (zcosfl) sind 2q d8. 



(D2) 

On the other hand, the probabilities p^ Im have the form 



P^ 



(D3) 



Pi 



P^ 



2 

-, — K 



[«(/, 



o,c i" Lqx) 



C(/ u + i_i lC )], 

2 r. e 



e —{^(I 0X + L , ( ) + c[--{l-^- 
(1 - 2k)(J 1iC + L_i, c ) + C(/ 2 ,c + i 2 ,c)] } 
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